tests: generate DKIM RSA keys on the fly via cryptography

Drop the hardcoded 1024-bit PRIV_KEY/PUB_KEY constants and the dead
_generate_key() fallback (Crypto.PublicKey was never installed in test
deps). A session-scoped fixture now mints a fresh 2048-bit keypair using
the cryptography package, fixing CodeQL py/weak-crypto-key alert #7.

Author: lavr

emails/testsuite/message/test_dkim.py

@@ -1,60 +1,45 @@
-import os
-import email
 import pytest
 import emails
 from emails import Message
 from io import StringIO
 
 from emails.exc import DKIMException
-from emails.utils import load_email_charsets
 import dkim
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from .helpers import common_email_data
 
 
+@pytest.fixture(scope="session")
+def dkim_keys():
+    """Fresh 2048-bit RSA keypair for DKIM tests.
 
-PRIV_KEY = b"""-----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDKHKzbg7LwpSJVfy9h8YQciVuIiexJ6OKJcCc6akJuLx+qPJGr
-t0chdV92slT9Lm1DUAjQEd8r9kVKa8FrWrnThMWx5HoXkGOIW2NqC0vrTZUgvhWy
-mlnwiysIylCirStZvA2uszYiFQK8slYD3H25UFTIOqLgB6AvV6URo26iJQIDAQAB
-AoGAOHt5B0Ov3zaW+MO5byq6m+r7DJZW1XTi0jvoipelhvteYwnYP9/RXhVaH2bI
-/5RY7qXQQK2t67BAPwMMI79QDL+jWsgwE0hly/qloOgEuX1+D/yGBShlYNQXvjAY
-UgkNYtp5JBVr8byz7upzvIyDsWJGoUrBindYnEiAVgwzZuECQQDKsKRwQhTCOZjW
-tkrockxDKMlXyKRLpOdqmwH0hwUdcWklxlmE+IJz4NVlz5qCVJz/oT+TgBNex8I5
-spxWAmdNAkEA/0UdnlXYueGVDIe5SUQGlXb8U8fTYtA/NsduFwq8QEWMrVBXK+uH
-4upq70kFlyfP5mpTOZwUgY2jH/qrXD8qOQJAdx1L5bTP4jxa94N1jhjtfGJRwMbm
-1pV4cgvaIEvg06a8djiUjzJD57lvbz+Lu5/iC9BFPnd76q1WFPZELb+H2QJBAK8y
-DWDlBEiW5QfjgqwhDu+36PfLNm4kBK6g8xLHYGowEZvFfv56uRloz5mIoVibj1lR
-ceshDwXXYrSJAuDdzSkCQDkx2TeKLUqKSxJNUYSrakQIo/41AOFvFBTbJuH3RZoy
-W/1DFMld7rC2gVHYW3m/LNd1qbi5QR9/buGxE7Y8ylI=
------END RSA PRIVATE KEY-----"""
-
-PUB_KEY = b"""MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKHKzbg7LwpSJVfy9h8YQciVuI
-iexJ6OKJcCc6akJuLx+qPJGrt0chdV92slT9Lm1DUAjQEd8r9kVKa8FrWrnThMWx
-5HoXkGOIW2NqC0vrTZUgvhWymlnwiysIylCirStZvA2uszYiFQK8slYD3H25UFTI
-OqLgB6AvV6URo26iJQIDAQAB"""
-
-
-def _generate_key(length=1024):
-    # From: http://stackoverflow.com/questions/3504955/using-rsa-in-python
-    try:
-        from Crypto.PublicKey import RSA
-        key = RSA.generate(length)
-        return key.exportKey(), key.publickey().exportKey()
-    except ImportError:
-        return PRIV_KEY, PUB_KEY
-
-
-def _check_dkim(message, pub_key=PUB_KEY):
+    Returns (private_key_pem, public_key_pem) as bytes.
+    Generated once per test session — RSA keygen is slow (~100 ms).
+    """
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    priv_pem = key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    pub_pem = key.public_key().public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    return priv_pem, pub_pem
+
+
+def _check_dkim(message, pub_key):
     def _plain_public_key(s):
         return b"".join([l for l in s.split(b'\n') if not l.startswith(b'---')])
     message = message.as_string()
     o = dkim.DKIM(message=message.encode())
     return o.verify(dnsfunc=lambda name, **kw: b"".join([b"v=DKIM1; p=", _plain_public_key(pub_key)]))
 
 
-def test_dkim():
-
-    priv_key, pub_key = _generate_key(length=1024)
+def test_dkim(dkim_keys):
+    priv_key, pub_key = dkim_keys
 
     DKIM_PARAMS = [dict(key=StringIO(priv_key.decode()),
                         selector='_dkim',
@@ -75,21 +60,13 @@ def test_dkim():
         message.dkim(**dkimparams)
         # check DKIM header exist
         assert message.as_message()['DKIM-Signature']
-        #print(__name__, "type message.as_string()==", type(message.as_string()))
-        #print(message.as_string())
-        #print(type(message.as_string()))
-        #print(email.__file__)
-        #print(email.charset.CHARSETS)
-        #print('adding utf-8 charset...')
-        #email.charset.add_charset('utf-8', email.charset.BASE64, email.charset.BASE64)
-        #print(email.charset.CHARSETS)
         assert 'DKIM-Signature: ' in message.as_string()
         assert _check_dkim(message, pub_key)
-        #assert 0
 
 
 
-def test_dkim_error():
+def test_dkim_error(dkim_keys):
+    priv_key, _ = dkim_keys
 
     m = emails.html(**common_email_data())
 
@@ -110,7 +87,7 @@ def test_dkim_error():
 
     # Error on invalid dkim parameters
 
-    m.dkim(key=PRIV_KEY,
+    m.dkim(key=priv_key,
            selector='_dkim',
            domain='somewhere.net',
            include_headers=['To'])
@@ -120,7 +97,7 @@ def test_dkim_error():
         m.as_string()
 
     # Skip error on ignore_sign_errors=True
-    m.dkim(key=PRIV_KEY,
+    m.dkim(key=priv_key,
            selector='_dkim',
            domain='somewhere.net',
            ignore_sign_errors=True,
@@ -130,19 +107,18 @@ def test_dkim_error():
     m.as_message()
 
 
-def test_dkim_as_bytes():
-
-    priv_key, pub_key = _generate_key(length=1024)
+def test_dkim_as_bytes(dkim_keys):
+    priv_key, _ = dkim_keys
     message = Message(**common_email_data())
     message.dkim(key=priv_key, selector='_dkim', domain='somewhere.net')
     result = message.as_bytes()
     assert isinstance(result, bytes)
     assert b'DKIM-Signature: ' in result
 
 
-def test_dkim_sign_after_error():
+def test_dkim_sign_after_error(dkim_keys):
     """After a sign error with ignore_sign_errors, normal signing still works."""
-    priv_key, pub_key = _generate_key(length=1024)
+    priv_key, pub_key = dkim_keys
 
     # First: sign with invalid include_headers (missing From), error ignored
     m1 = Message(**common_email_data())
@@ -156,14 +132,14 @@ def test_dkim_sign_after_error():
     assert _check_dkim(m2, pub_key)
 
 
-def test_dkim_sign_twice():
+def test_dkim_sign_twice(dkim_keys):
 
     # Test #44:
     # " if you put the open there and send more than one messages it fails
     #   (the first works but the next will not if you dont seek(0) the dkim file first)"
     # Actually not.
+    priv_key, pub_key = dkim_keys
 
-    priv_key, pub_key = _generate_key(length=1024)
     message = Message(**common_email_data())
     message.dkim(key=StringIO(priv_key.decode()), selector='_dkim', domain='somewhere.net')
     for n in range(2):

requirements/tests-base.txt

@@ -6,3 +6,4 @@ pytest-cov
 pytest-asyncio
 html5lib
 aiosmtplib
+cryptography